I trust people with money as their motive about as much as I'd trust a serious alcoholic to hold on to a bottle of booze for me without taking a sip. Might not

I trust people with money as their motive about as much as I'd trust a serious alcoholic to hold on to a bottle of booze for me without taking a sip. Might not be a popular opinion but it is my 2 cents to spend. Could a someone at an open source project slip in an obfuscated backdoor in some esoteric area of the OS? Of course. But the risks of being found out are so much higher, after the fact that all changes at an open source project are logged, diffed, and public (normally), even if only 10% of the userbase looks at the code, runs packet capture or an SSL bump on the network traffic, etc, that is 10% more than for products by Microsoft, Apple, Google, and unlike an insider with access who discovers something highly questionable at a massively powerful corporation, an open source project has almost no leverage to compel them to keep their mouth shut, meanwhile the risk for developers of an open source project that does something like that (even if they aren't in the know) is total loss of trust, forever. Couple all of that with targeting a highly technical audience (drug kingpins looking for secure comms are more c-suite than engineers, they are still caught up on a good sales pitch more than hard technical details e.g. Anom ) and you'd be fairly stupid to try to pull the wool over their eyes and expect it to not eventually get discovered.